CVE-2014-5269 Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a cr...
MediumCVSS 5.0
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libplack-perl(Debian:12) | < 1.0031-1 | 1.0031-1 |
| debian/libplack-perl(Debian:13) | < 1.0031-1 | 1.0031-1 |
| debian/libplack-perl(Debian:14) | < 1.0031-1 | 1.0031-1 |
| plack project plack | <= 1.0030 | No fix listed |
References
- Debian Security Tracker CVE-2014-5269 vendor-advisory
- api.metacpan.org
- FEDORA-2014-9544 vendor-advisory
- FEDORA-2014-9542 vendor-advisory
- [oss-security] 20140816 Re: CVE Request: Plack::App::File does not prune trailing slashes: possible code exposure / information disclosure mailing-list
- 109928 vdb-entry
- github.com patch vendor-advisory
- github.com patch vendor-advisory